Hacker News Reader

Comment by braythwayt | Hacker News Reader

Likely not. If you are the kind of organization that installs this kind of hardware, you aren’t the kind of organization that permits users to configure their own machines in any substantial way, much less to work around the monitoring you worked so hard to establish.

Likewise, if you are that kind of organization, how hard would it be to set up the network such that only traffic from the MiTM hardware is allowed to go through the network? Is there any reason to permit local machines to establish connections outside the network for any reason?

View on HN

We're talking about a university. It'd be extremely strange for students and faculty not to use their personal laptops.

My university runs like a corporate IT department for its offices, hospital, etc. but for any part of it an undergrad will ever see, IT is just a WiFi-based ISP.

My alma mater required OS X users to install a kernel extension on their personal machines. I assume it wanted to do something like this.

Wow, what school? That sounds like a totally unacceptable violation of ownership of personal property and a great reason to avoid studying/working there.

My employer does that for company-issue laptops (we keep root as long as we accept the rootkit), but for personal ones that's unbelievable.

Stanford has done stuff with requiring people to install particular monitoring software on personal devices in order to access SUNet (the main stated purpose being to ensure that users were running approved anti-malware scanners). I don't know what the current status is.

Looks like I misremembered and it wasn't a kernel extension. It was a product called SafeConnect by Impulse. Based on the instructions I can find, it doesn't seem to require root so it must not be a kernel extension. But on contemporary Unix-y systems like OS X and GNU / Linux, pretty much all your privacy is gone if there is a rogue process running as you. You don't need root.

In any case, my attitude was that it was their network and they could put any restrictions on it, although they may be in very bad taste.

>it was their network and they could put any restrictions on it

Would you say the same of Comcast? When it is the only ISP serving the apartment you just signed a lease on?

Because that is basically the position of an undergrad in university housing with respect to "their network." You could say they had a choice not to go to that school, but for a state school system?

On a network engineering level, something is deeply wrong if you can't separate internet access from access to sensitive resources. Or if you are treating a subnet which includes tens of thousands of students as "trusted."

> On a network engineering level, something is deeply wrong if you can't separate internet access from access to sensitive resources. Or if you are treating a subnet which includes tens of thousands of students as "trusted."

I don't disagree with you. And I hate that I only have one choice of ISP.

I'm sure they were able to separate internet access from sensitive resources. But without forcing their users to install some piece of shit tracking software, how would they know who to forward letters to from the MPAA? ;)

Reply on news.ycombinator.com